mTLS + JWT authentication

Security
1

We are currently using JWT based end user authentication (Origin authentication). Now we are planning to use SSL certificate authentication via a whitelist of certificates allowed to connect end users (client). However, we want to have this in our Ingress Gateway.

Does istio ingress gateway has the support to handle both type of request.

  • if request has JWT token in header it should use the origin verification using the JWT issuer and provider config.
  • If request has the certificate then it validate the end user using the configured tls settings(serverCertificate, privateKey, caCertificates)
2

if request has JWT token in header it should use the origin verification using the JWT issuer and provider config.

this can be done with AuthorizationPolicy on ingress gateway that allows the request if it has a valid JWT token.

If request has the certificate then it validate the end user using the configured tls settings(serverCertificate, privateKey, caCertificates)

This is not supported on ingress gateway for now. the authorization policy needs some update if you want to use it to enforce access control based on arbitrary fields in the x509 cert issued by non-istio CA.

1 Like